Data Exposure Vulnerability in Apache Camel Thrift Component

CVE-2026-85245

What is CVE-2026-85245?

The Apache Camel Thrift component has a vulnerability where incoming data is unmarshalled into a shared instance of the target type rather than a fresh copy. This leads to the accidental sharing of data between processed messages. Specifically, when one message's state is written to the shared object, it remains visible to subsequent messages that utilize the same type. This can cause sensitive information from one user to be exposed to another in multi-tenant environments. Users are urged to upgrade to version 4.23.0 or apply patches in the 4.18.x and 4.22.x LTS release streams to mitigate this issue.

References